I am doing a security scan with OWASP that detects a vulnerability by remote injection of operating system commands, through the GET method, therefore it shows me a URL like this
www.mysite.com/create.php?id=167%27%3Bstart-sleep+-s+15&name=11
I understand that it forces the server to sleep for 15 seconds, but the problem is that if the thread is really sleeped, the website should delay the loading process by about 15 seconds, but the web page loads instantly, even if I replace the 15 by 60 or 120, the page still loads instantly.
Also, the OWASP report doesn't show me any text in the evidence field.
Any ideas? Is it possible that OWASP throws a false alert? Or does the sleep command not sleep the thread? Why is the remote command not running?